Pankraz76 opened a new pull request, #13624: URL: https://github.com/apache/maven/pull/13624
Fixes #10850 (MNG-8078) — the part of it that is a defect; see "Scope of this change" below. ## Problem When two imported BOMs manage the same dependency, `DefaultDependencyManagementImporter` warns that the second entry is ignored unless both are equal. Reproduced on current `master` with two local BOMs and a project importing both. Maven 3.9 emits none of these warnings, so only Maven 4 is affected: ``` Ignored POM import for: org.slf4j:slf4j-api:jar:2.0.12@compile as already imported org.slf4j:slf4j-api:jar:2.0.12@compile Ignored POM import for: g:opt:jar:1@compile as already imported g:opt:jar:1@compile Ignored POM import for: g:excl:jar:1@compile[2 exclusions] as already imported g:excl:jar:1@compile[2 exclusions] Ignored POM import for: g:realscope:jar:1@compile as already imported g:realscope:jar:1@test ``` Three of the four read "X as already imported X", so users cannot tell what conflicts. Two defects cause this: 1. **False positive:** exclusions are compared in declaration order, although they act as a set during dependency resolution. The same exclusions declared in a different order are reported as a conflict. 2. **Misleading message:** an unset scope is rendered as `@compile`, an explicit `optional=false` is hidden, and exclusions are shown only as a count. ## Why scope/optional differences are still reported An unset scope or optional flag in `dependencyManagement` is **not managed at all**: `DefaultArtifactDescriptorReader` passes `getScope()` through as-is and `getOptional() != null ? isOptional() : null`. An explicit `compile` or `false` does manage it. Those entries do differ, so the warning is legitimate; only its rendering was wrong. ## Changes - Compare exclusions as a set of `groupId:artifactId`. - Treat an empty scope like an unset one. - Render only what is declared: `@scope` when set, `[optional=true|false]` when set, and `[exclusions: g:a, ...]` instead of a count. Same reproducer after the fix — the false positive is gone and each remaining warning shows its difference: ``` Ignored POM import for: org.slf4j:slf4j-api:jar:2.0.12@compile as already imported org.slf4j:slf4j-api:jar:2.0.12 Ignored POM import for: g:opt:jar:1[optional=false] as already imported g:opt:jar:1 Ignored POM import for: g:realscope:jar:1 as already imported g:realscope:jar:1@test ``` ## Scope of this change The issue also asks not to warn when BOM entries differ only in scope or exclusions. Those differences do change what is managed (the second BOM's scope/exclusions are dropped), and the warning was introduced deliberately by MNG-7854, so this PR does not silence them. If maintainers prefer to relax that, it can be a follow-up; with this change such warnings at least state the difference. ## Tests - 5 new unit tests in `DefaultDependencyManagementImporterTest`: identical entries, reordered exclusions (no warning), and differing exclusions, scope and optional (the message names the difference). 4 of them fail on `master` with the "X as already imported X" message. - `mvn -pl impl/maven-impl verify`: 790 tests pass, with spotless, rat and checkstyle clean. - `DefaultModelBuilderTest` only matches the `Ignored POM import for:` prefix, which is unchanged. --- To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) check one of the following: - [ ] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) - [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Va2zqbKM91nFdbnRNj4iJ2 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
